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ABSTRACT 

The Islamic State of Iraq and al-Sham (ISIS) is a dominant 
insurgent group operating in Iraq and Syria that rose to 
prominence when it took over Mosul in June, 2014. In this 
paper, we present a data-driven approach to analyzing this 
group using a dataset consisting of 2200 incidents of mili¬ 
tary activity surrounding ISIS and the forces that oppose 
it (including Iraqi, Syrian, and the American-led coalition). 
We combine ideas from logic programming and causal rea¬ 
soning to mine for association rules for which we present 
evidence of causality. We present relationships that link 
ISIS vehicle-bourne improvised explosive device (VBIED) 
activity in Syria with military operations in Iraq, coalition 
air strikes, and ISIS lED activity, as well as rules that may 
serve as indicators of spikes in indirect fire, suicide attacks, 
and arrests. 


1. INTRODUCTION 

Since its rise to prominence in Iraq and Syria in June, 
2014, The Islamic State of Iraq and al-Sham (ISIS) - also 
known as The Islamic State of Iraq and the Levant (ISIL) 
or simply the Islamic State, has controlled numerous cities 
in Sunni-dominated parts of Iraq and Syria. ISIS has dis¬ 
played a high level of sophistication and discipline in its mil¬ 
itary operations in comparison to similar insurgent groups, 
which perhaps may be the source of its success. We have 
meticulously encoded and recorded 2200 incidents of mili¬ 
tary activity conducted by ISIS and forces that oppose it 
(including Iraqi, Syrian, and the American-led coalition) in 
a relational database. Our goal was to achieve a better un¬ 
derstanding of how this group operates - which can lead to 
new strategies for mitigating ISIS’s operations. Specifically, 
we sought to analyze the behavior of ISIS using concepts 
from logic programming (in particular APT logic 14 ) 


and causal reasoning [10[ |18| . By combining ideas from these 
fields, we have been able to conduct a thorough search for 
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rules whose precondition consists of multiple atomic propo¬ 
sitions, and we provide evidence of causality by comparing 
rules with the same consequence. So, in addition to consid¬ 
ering the probability of a rule (p), we also study a measure 


of its causality denoted eavg (previously introduced in 10 


which, informally, can be thought of as the average increase 
in probability a rule’s precondition provides when considered 
with each of the comparable rules. Using this approach, we 
have found interesting relationships - consider the following: 


• Weeks where ISIS conducts infantry operations in Iraq 
that are accompanied by indirect fire are indicative of 
vehicle-bourne improvised explosive device (VBIED) 
operations in Syria in the following week (p = 1.0, 
eavg = 0.92). 


• Weeks in which ISIS conducts operations in Tikrit 
and conducts a significant number of executions are 
followed by a large spike in improvised explosive de¬ 
vice (lED) usage in Iraq and Syria combined (p = 
1.0, ea.g = 0.97) 


• Air strikes by the Syrian government are followed by 
mass arrests by ISIS in the following week (eavg = 
0.91, p = 0.67), and such massive arrests were always 
proceeded by Syrian air strikes in our dataset. 


• In the week after coalition air strikes are conducted 
against Mosul while ISIS is conducting operations in 
Al-Anbar province, ISIS greatly increases its lED ac¬ 
tivity in Iraq (p = 0.67, Ca^g = 0.97). However, if 
there are also significant ISIS operations occurring in 
Syria, the increase in lED usage experienced there is 
(p = 0.67,ea„9 = 0.79). 

Our findings have also led us to several interesting theories 
about ISIS behavior that we have developed as a result of 
this data mining effort. These include the following: 

• ISIS may employ suicide VBIED operations in Bagh¬ 
dad prior to significant infantry operations in other lo¬ 
cations to prevent the deployment of Iraqi army/police 
reinforcements. 

• ISIS tends to leverage indirect fire (IDF) as a precursor 
to infantry operations - more in keeping with a tradi¬ 
tional military force as opposed to a primary use of 
IDF for harassment purposes (as was typically seen by 
insurgent groups during Operation Iraqi Freedom). 

• As we found relationships between coalition air oper¬ 
ations and an increase in ISIS usage of lEDs - and 






not other, larger weapons systems (i.e. VBIEDs), this 
may indicate that ISIS resorts to more distributed, 
insurgent-style tactics in the aftermath of such opera¬ 
tions. 


To our knowledge, this study represents both the hrst publicly- 
available, data-driven study of ISIS as well as the first com¬ 
bination of APT logic with the causality ideas of TO]. The 


rest of the paper is organized as follows. In Section ^we de¬ 
scribe our approach and recall key concepts from APT logic 
and causal reasoning. This is followed by a description of 
our corpus of military events surrounding the actions of ISIS 
from June-December, 2014 in Section[^ In Section]^ we de¬ 
scribe our implementation and discuss our results. Finally, 
related work is reviewed in Section 0 


2. TECHNICAL APPROACH 


2.1 APT Logic 

We now present a subset of our previously-introduced 
APT logic [14| |15| . Our focus here is on the syntax of the 
language utilized with an alternate semantics that is based 
on the rule-learning approach described in [l4l. This is due 


to the fact that we are only concerned with learning the 
rules in this paper and determining their level of causality 
- we leave problems relating to deduction (i.e. the entail- 
ment problem studied in [^) to future work. APT logic 
considers a two-part semantic structure: threads (sequences 
of events) and interpretations (probability distributions over 
such sequences). Initially, we focus on a semantics restricted 
to threads. 

We assume the existence of a set of ground atoms, A which 
in this case correspond with events over time and use the 
symbol n to denote the size of this set. We shall partition 
the ground atoms into two subsets: action atoms Aact and 
environmental atoms Aenv Action atoms describe actions 
of certain actors, and environmental atoms describe aspects 
of the environment. We will use nact,nenv to denote the 
quantity of ground atoms in Aact,Aenv, respectively. We 
can connect atoms using -i,A,V to create formulas in the 
normal way. A world is a subset of atoms that are considered 
to be true. A thread is a series of worlds, each corresponding 
to a discrete time-point, which are represented by simple 
natural numbers in the range 1,..., tmax. We shall use Th[t] 
to refer to the world specified by Th at time t. A thread 
( Th) at time t satisfies a formula / (denoted Th[t] \= f) by 
the following recursive definition: 


For some a £ A, Th\t\ |= a iff a £ Th\t] 


Note that we use the notation | ■ | for the cardinality of a set. 
Our goal in this section is for some event g to identify previ¬ 
ously occurring event c such that the conditional probability 
of g occurring given c is greater than pg. In this paper, we 
shall only look at finding APT rules where c occurs in the 
time period right before g. The case where multiple time pe¬ 
riods elapse between c and g is left to future work. Hence, we 
introduce an APT rule of the following form: c g, which 
intuitively means that “c is followed by g in one time-step 
with probability p.” We shall refer to c as the precondition 
and g as the consequence. We say thread Th\= c g iff: 


|{t s.t. Th[t] 1= c and Th\t + 1] ^ p}| 

^ ^ \{t s.t. Th[t]\=c}\ 

This alternate definition of semantics is not new: it is a vari¬ 
ant of rule satisfaction with the existential frequency func¬ 
tion of [14| a nd also of “trace semantics” used for a PCTL 
variant in M. In this paper, we are focused on learning rules 
where c is a conjunction of positive atoms and p is a single 
positive atom. The number of atoms in the conjunction c is 
referred to as the “dimension” of the rule c '^p g. We will 
also be concerned with two other measures of a given rule: 
the “negative probability” (used to describe the probabilistic 
rules of |17| ) and the notion of support (a standard concept 
in association rule learning). First, we dehne “negative prob¬ 
ability” - denoted p* - for a given rule of the aforementioned 
format. 


|{f s.t. Th[t] 1= g and Th\t — 1] ^ c}| 
\{t s.t. Th[t] ^ g}\ 


(3) 


Simply put, p* is the number of times that the consequence 
of a rule occurs without the head occurring prior. We can 
think of p as a measure of precision of a given rule while p* 
is more akin to a measure of recall. Next, we formally define 
the notion of support (s) as follows. 


s = |{t s.t. Th[t] 1= c}| (4) 


For a given rule r, we shall use the notation pr,p*,Sr, re¬ 
spectively. We will also use the notation pr to denote the 
prior probability of the consequence. When it is obvious 
from context which rule we are referring to (as in the exper¬ 
imental results section), we will drop the subscript. 


2.2 Determining Causality 

Next, we describe how for a given action, g, we identify 
potential causes based on a set of rules for which g is the 
consequence. In considering possible causes, we must first 
identify a set of prima facie causes for g [10[ |18| . We present 
the dehnition in terms of APT logic below. 


• For / = ^/', Th[t] \= f iS Th[t] |= /' is false 
. For / = f'Af", Th[t] h / iff Th[t] ^ /' and Th[t] h /" 


Definition 2.1 (Prima Facie Cause [^[^). Given 
APT logic formulas c, g and thread Th, we say c is a prima 
facie cause for g w.r.t. Th if: 


. For / = /' V /", Th[t] 1= / iff Th[t] h /' or Th[t] h /" 

We also note that based on how often a given formula oc¬ 
curs within a thread, we can obtain a prior probability for 
that formula. For instance, consider formula g. We can com¬ 
pute its prior probability (w.r.t. thread Th) as the fraction 
of time points where g is satished: 

\{t\Th\t] ^g}| 

tmax 


1. There exists time t such that Th[t] \= g (g occurs with 
a probability greater than zero) 

2. There exists t,t' where t < t' such that Th[t] \= c and 
Th[t'] \= g (c occurs before g) 

3. For r = c g where Th \= r, we have p > pr (the 
probability of the consequence occurring after the pre¬ 
condition is greater than the prior probability of the 
consequenee) 










As we will assume the existence of a single thread, Th 
(which is our historical corpus of data), we will often use the 
language “prima facie causal rule” or “PF-rule” to describe 
a rule c g where c is a prima facie cause for g w.r.t. Th. 

Next, we adopt the method of to determine if an APT 
rule is causal. First, in determining if a given PF-rule is 
causal, we must consider other, related PF-rules. Intuitively, 
a given rule r = c '^p g explains why some instances of g 
occur within a thread. Another rule r' = c' g is related 
if it also explains why some of those same instances occur. 
Formally, we say r and r' are related if there exists t such 
that Th[t] 1= c A c' and Th\t -\- 1] |= g. Hence, we will define 
related PF-rules (for a given rule r = g) as follows. 

R(r) = {r s.t. r' ^ r and r,r' are related} 

Next, we will look at how to compare two related rules. 
The key purpose from behind doing so is to study how 
the probability of the rule changes in cases where both pre¬ 
conditions co-occur in comparison to the probability where 
exactly one of the preconditions occurs. So, given rules r, r' 
as defined above, we have the following notation: r' and 

p^r.r', which are dehned as the point probabilities that will 
cause the following two rules to be satisfied by Th. 

c /\c! ~»p^ g 
~<c A c' g 

So, Pr.r' is the probability that g occurs given both precon¬ 
ditions, and p^r.r' is the probability that g occurs given just 
the precondition of the second rule and not of the first. The 
idea is that if p^y — p^ry > 0, then there is something 
about the precondition of r that causes occur that is 
not present in r'. Following directly from jl0| , we measure 
the average of this quantity to determine how causal a given 
rule is as follows: 

_ J^r’enyPry — P^ry 

“ |R(r)| 

Intuitively, eavg{r) measures the degree of causality exhib¬ 
ited by rule r. Additionally, using this same intuition, we 
find it useful to include a few other related measures when 
examining causality. First, we define tmin, defined below: 

emin — min }Pr 

r' GR.(r) 

This tells us the “least causal” comparison of r with all re¬ 
lated rules. Another measure we will use is e/rac, defined as 
follows: 

\{r' s.t. {pry -p^ry) > 0}| 

E/-c(r) = -- 

This provides a fraction of the related rules whose proba¬ 
bility remains the same or decreases if the precondition of 
r is not present. Hence, a number closer to 1 likely indi¬ 
cates that r is more causal. By using multiple causality 
measurements, we can have a better determination of more 
significant causality relationships. 

2.3 Algorithms 

Next, given a thread, we provide a variant of the APT- 
Extract algorithm that we call PF-Rule-Extract. Es¬ 
sentially, this algorithm generates all possible Aenv up to a 
certain size (specified by the argument MaxDim) and then 


searches for correlation. It returns rules whose precondi¬ 
tion occurs a specified number of times (a lower bound on 
support for a rule) - specified with the argument SuppLB. 
We make several modifications specific to our application to 
support reasoning. 

• We reduce the run-time of the algorithm considerably 

over APT-Extract. As APT-Extract explores all possi¬ 
ble combinations of atoms up to size MaxDim^ it runs 
in time However, PF-Rule-Extract only 

examines combinations of atoms that occur in a given 
time period - hence, reducing run-time to 0( ) 

where nt is the number of atoms in Aenv true at time 
t. We find in practice that maxt(nt) << Uenv 

• We further reduce the run-time by not considering el¬ 
ements of Aenv that occur less than the lower bound 
on support - as they would never appear in a rule. 

• We guarantee that all rules returned by PF-Rule-Extract 
are PF-rules. 


Algorithm 1 PF-Rule-Extract 

Require: Thread Th, sets of atoms Aact,Aenv, posi¬ 
tive natural numbers MaxDim, SuppLB, real number 
minProb 

Ensure: Set of rules R 
1: Set R = 0 

2: for g G {a G Aact s.t. 3t where Th[t\ ^ a} do 
3: preCond{g) = 0 

4: for t G {1 ^max S. t. Th[t + 1] 1= g} do 

5: Let X be the set of all combinations of size 

MaxDim (or less) of elements in Th[t] C[Aenv that 
occur at least SuppLB times. 

6: preCond{g) = preCond{g) U X 

7: end for 

8: for c G preCond{g) do 

9: Compute p,p,s, as per Equations |1|2| and|^ 

10: if (s > SuppLB) A {p > p) A {p> minProb) then 

11: R = R U {r} 

12: end if 

13: end for 

14: end for 
15: return Set R 


Note that APT-Extract allows for multiple time periods 
between preconditions and consequences - PF-Rule-Extract 
can also be easily modified to hnd rules of this sort through a 
simple modification of line 4. Next, we provide some formal 
results to show that PF-Rule-Extract finds rules that meet 
the requirements of Definition |2.1| and show that it explores 
all possible combinations up to size MaxDim that are sup¬ 
ported by the data that meet the requirement for minimum 
support even with our efficiency improvements. 

Proposition 2.1. Given thread Th as input, PF-Rule- 
Extract produces a set of rules R such that each r G R is a 
prima facie causal rule. 

Proof. The first requirement for a prima facie cause is 
met by line 2 of PF-Rule-Extract, as the algorithm only con¬ 
siders consequences that have occurred at least once in Th - 
hence, they have a prior probability greater than zero. The 









second requirement is met by line 4, as we only consider 
atoms that occurred immediately before the consequence 
when constructing the precondition. Finally, the third con¬ 
dition is met by the if statement at line 10 which will only 
select rules whose probability is greater than the prior prob¬ 
ability of the consequence. □ 

Proposition 2.2. PF-Rule-Extract finds all PF-rules whose 
precondition is a conjunction of size Max Dim or a size con¬ 
taining fewer atoms and where both the precondition occurs 
at least SuppLB times in Th and the probability is greater 
than minProb. 

Proof. By Proposition |2.1[ every consequence that could 
be used in a PF-rule is considered, so we need only to con¬ 
sider the precondition. Suppose that there is a PF-rule 
whose precondition occurs at least SuppLB times that has a 
size of Max Dim or smaller. Hence, the precondition is com¬ 
prised of m < MaxDim atoms: oi,..., Um- Clearly, as this 
precondition occurs at least SuppLB times in Th, each of 
fli,..., Um must also occur SuppLB times by line 5 - so that 
the precondition must be considered at that point. The only 
condition that would prevent the rule from being returned 
is line 10, but again, clearly these are met by the statement 
of the proposition. Hence, we have a contradiction. □ 

Once we have identified the PF-rules using PF-Rule-Extract, 
we must then compare related rules with each other. The al¬ 
gorithm PF-Rule-Compare returns the top k rules for each 
consequence. Again, here we take advantage of our spe¬ 
cific application to reduce the run-time of this comparison. 

In particular, for a given rule, we need not compare it to 
all the rules returned by PF-Rule-Extract; we only need to 
compare it to those that share the consequence. By sorting 
the rules by consequence - a linear time operation (line 3), 
we are able to reduce the cost of the quadratic operation 
for the rule comparisons (a brute-force method would take 
0(|R|^) while this method requires 0((maxg |Rg|)^ -I- |R|) - 
and we have observed that maxg |Rg| << |R|). 


Algorithm 2 PF-Rule-Compare 
Require: Set of rules R, natural number k 
Ensure: Set of rules R' 

1: Set R' = 0. 

2: for g £ Aact do 
3: Set Rg = {c ~>p g £ R} 

4: for r £ Rg do 

5: Calculate Cavg for rule r (Equation by comparing 

it to all related rules in Rg \ {r}) 

6: end for 

7: From the set Rg, add the top k rules by Cavg to the 

set R' 

8: end for 
9: return Set R' 


3. ISIS DATASET 

We collected data on 2200 military events that occurred 
from June 8th through December 31st, 2014 that involved 
ISIS and forces opposing ISIS. Events were classified into one 
of 159 event types - and these events were used as predicates 
for APT logic atoms. We list a sampling of the predicates 
we used in Table Many predicates are unary because 


they correspond with ISIS actions (i.e. armedAtk) while 
those dealing with operations by other actors (i.e. airOp) 
and predicates denoting spikes in activity (i.e. VBIEDSpike) 
accept more than one argument. Nearly every predicate has 
one argument that corresponds to the location in which the 
associated event took place. See Figure for a sampling of 
locations in the ISIS dataset. 

We obtained our data primarily from reports published by 
the Institute for the Study of War (ISW) [^, and we aug¬ 
mented it with other reputable sources including MapAction 
, Google Maps , and Humanitarian Response . We 
devised a code-book as well as coding standards for events, 
and one of our team members functioned as a quality-control 
to reduce errors in human coding. 


Figure 1: Map illustrating cities associated with events in 
the ISIS dataset. 




4. RESULTS AND DISCUSSION 
4.1 Experimental Setup 

We implemented our PF-Rule-Extract and PF-Rule-Compare 
in Python 2.8x and ran it on a commodity machine equipped 
with an Intel Core i5 CPU (2.7 GHz) with 16 GB of RAM 
running Windows 7. The time periods we utilized were 
weeks - hence, we had 30 time periods in our thread. We had 
980 distinct environmental atoms (Menu). Our action atoms 
[Aact) corresponded to weeks where the number of incidents 
for certain activity rose to or past one or two moving stan¬ 
dard deviations (denoted 1 x cr, 2 x cr respectively, computed 
based on the previous 4 weeks) above the four-week moving 
average (computed based on the previous 4 weeks). We re¬ 
fer to these atoms as “spikes” and show some sample atoms 
denoting such spikes in Table The spikes are designated 
for three locations: Iraq, Syria, or both theaters combined. 

We also included these spikes in the set of environmental 
atoms as well {Aact C Aenv)- 

We set the parameters of PF-Rule-Extract as follows: 
MaxDim = 3, SuppLB = 3, minProb = 0.5. For PF-Rule- 
Compare, we did not set a particular k value. Instead, we 
used Cavg to rank the rules by causality for a given conse¬ 
quence. In this paper, we report the top causal rules (in 
terms of Cavg) for some of the consequences. We also note 
that the number of related rules provides insight into that 
rule’s significance - we discuss this quantity in our analy¬ 
sis. We examine some of the top rules in terms of tavg and 











Table 1: A sampling of predicate symbols used to describe 
events in the ISIS Dataset _ 


Predicate 

Intuition 

airOp(A,y) 

Actor X (typically “Coalition,” 
“Syrian Government,” or “U.S.”) 
conducts an air campaign against 
ISIS in the vicinity of city Y. 

armedAtk(A') 

ISIS conducts an armed attack 
(a.k.a. infantry operation) in city 
X. 

lED(X) 

ISIS conducts an attack using an 
improvised explosive device (lED) 
in city X. 

indirectFire(X) 

ISIS conducts an indirect fire oper¬ 
ation (i.e. mortars) near city X. 

VBIED(X) 

ISIS conducts an attack using a 
vehicle-bourne improvised explo¬ 
sive device (VBIED or car-bomb) in 
city X. 

armedAtkSpike(X, Y) 

There is a spike in ISIS armed 
attacks in country X that is Y 
amount over the 4-month moving 
average (y is expressed in terms of 
moving standard deviations). 

VBIEDSpike(X,y) 

There is a spike in ISIS VBIEDs in 
country X that is Y amount over 
the 4-month moving average (y is 
expressed in terms of moving stan¬ 
dard deviations). 


describe the military insights that they provide. Our team 
includes a former military officer with over a decade of expe¬ 
rience in military operations that includes two combat tours 
in Operation Iraqi Freedom. In addition to ea„g, we also ex¬ 
amined the rule’s probability (p) - the fraction of times the 
consequence follows the precondition, the negative proba¬ 
bility (p*) - the fraction of times the consequence is not 
proceeded by the precondition, the prior probability of the 
consequence (p), and the additional causal measures intro¬ 
duced in this paper - emin, ^frac- The relationship specified 
in the rule can be considered more significant if p > > p, p* 
is closer to 0, tmin > 0, and tavg,tfrac are close to 1. These 
measures are discussed in more detail in Section [21 

4.2 Algorithm Efficiency 

In Section we described some performance improve¬ 
ments that we utilized in PF-Rule-Extract (which is based 
on APT-Extract [^) that are specific to this application. 
The first performance improvement was the reduction in the 
number of atoms used to generate the preconditions (which 
were conjunctions of atoms of up to size 3 in our experi¬ 
ments). First, we limited the number of atoms to be used 
in such combinations based on the weeks in which they oc¬ 
curred. Even though we had 980 environmental atoms, no 
more than 93 occurred during any given week (this is the 
value maxt(nt) from Section [^. Further, by eliminating 
atoms that occurred less than the SuppLB from consider¬ 


ation, this lowered it further to 49 atoms per week at the 
most. This directly leads to fewer combinations of atoms 
generated for the precondition. A comparison is shown in 
Table Note that the values for APT-Extract are exact, 
while the remaining are upper bounds. Again, this sub¬ 
stantial, multiple-order-of-magnitude savings in the number 
of rules explored is a result of the relative sparseness of our 
dataset and the fact that our preconditions consisted of con¬ 
junctions of positive atoms. This efficiency is primarily what 
enabled us to find and compare rules in a matter of minutes 
on a commodity system. 


Table 2: Improvement in Algorithm Efficiency 


Technique 

Atoms 

Combinations 

Explored 

APT-Extract 14 

980 

182,122,025 

max* (nt) 

93 

8, 853, 042 

maxt(nt) and consider 
only atoms that occur more 
than SuppLB times 

49 

1,296,834 


4.3 ISIS Military Tactics 

In this section, we investigate rules that provide insight 
into ISIS’s military tactics - in particular, we found inter¬ 
esting and potentially casual relationships that provide in¬ 
sight into their infantry operations, use of terror tactics (i.e. 
VBIEDs), and decisions to employ roadside bombs and to 
launch suicide operations. 

Table 3: Causal Rules for Spikes in Armed Attacks (Iraq 
and Syria Combined) 


No. 

Precondition 

€-avg 

P 

* 

P 

1. 

indirectFire(Baiji)A 

armed Atk(Balaci) 

0.81 

0.67 

0.50 

2. 

indirectFire(i3aiji)A 

armedAtk(i?aZad)A 

\/B\ED{Baghdad) 

0.81 

0.67 

0.50 


Armed Attacks. The prior probability of large spikes 
(2 X a) (see figure for ISIS armed attacks for Iraq and 
Syria was 0.154. However, for our two most causal rules 
for this spike (Table [^, we derived this probability as 0.67. 
Such spikes likely indicate major infantry operations by the 
Islamic State. Rule 1 states that indirect fire at Baiji (at¬ 
tributed to ISIS) along with an armed attack in Balad leads 
to a spike in armed attacks by the group in the next week 
while rule 2 mirrors rule 1 but adds VBIED activity in Bagh¬ 
dad as part of the precondition. We note the relatively high 
p* (0.5 in this case), which indicates that each spike in armed 
attacks of this type are not necessarily proceeded by this pre¬ 
condition, despite the relatively high value for Savg, hinting 
at causality (each of these rules was compared with 265 re¬ 
lated rules and had tfrac = 1 and emin = 0 - showing little 
indication of a related rule being more causal). We believe 
that the strong causality and the high value for p* indicate 
that these rules may well be “token causes” - causes for a 
specific event - in this case, we think it is likely ISIS offensive 




























operations in Baiji. This makes sense, as a common military 
tactic is to prepare the battlefield with indirect fire (which it 
seems ISIS did in the prior week). It is unclear if the VBIED 
incidents in Baghdad are related due to the co-occurrence. 
That said, it is notable that VBIED operations are often 
used as “terror” tactics as opposed to part of a sustained 
operation. If so, this may have been part of a preparatory 
phase (that included indirect fire in Baiji), and the purpose 
of the VBIED events in Baghdad was to prevent additional 
Iraqi Security Force deployment from Baghdad to Baiji. We 
note in one case supporting this rule (on July 25th, 2014) 
that ISIS also conducted lED attacks on power-lines that 
support Baghdad - which may have also been designed to 
hinder deployment of reinforcements. Here, it is also im¬ 
portant to note the ongoing Infantry operations in Balad 
(specified in the precondition) - which would consume ISIS 
resources and perhaps make it more difficult to respond to 
further deployment of government security forces. Though 
this is likely a token cause, this may be indicative of ISIS 
tactics when preparing to concentrate force on certain ob¬ 
jectives (in this case Baiji) while maintaining ongoing op¬ 
erations (Balad), as a spike in armed attacks likely indi¬ 
cates a surge of fight infantry-style soldiers into the area (a 
manpower-intensive operation). 


Figure 2: ISIS Spikes in Armed Attacks in Iraq and 
Syria per Week 



Spikes in VBIED Incidents. VBIED incidents have been 
a common terror tactic used by religious Sunni extremist 
insurgent groups in Iraq in the past - including A1 Qaeda 
in Iraq, Ansar al Sunnah, Ansar al Islam, and now ISIS. 
We found two relationships that are potentially causal for 
spikes in VBIED activity in Iraq and Syria combined, shown 
in Table H 

Table 4: Causal Rules for Spikes in VBIED Incidents in 
Iraq and Syria Combined 


No. 

Precondition 

^avg 

P 

P* 

3. 

armedAtk(i?aZad)A 

indirectFire(i3aij7) 

0.95 

1.00 

0.25 


Rule 3 states that if infantry operations in Balad accom¬ 
panied by indirect fire operations in Baiji occur, we should 
expect a major (2 x a) spike in VBIED activity (see fig¬ 
ure by ISIS (Iraq and Syria combined). We believe this 
rule provides further evidence of the use of VBIEDs to pull 


security forces away from other parts of the operational the¬ 
ater. It is interesting to note that the negative probability 
is only 0.25 - which means that most of the VBIED spikes 
we observed were related to operations in Balad and Baiji. 
This highlights the strategic importance of these two cities 
to ISIS: Baiji is home to a major oil refinery while Balad is 
near a major Iraqi air base. We also found solid evidence of 
causality for this rule - based on 209 related rules, we found 
train = 0.5 which means adding a second precondition to 
this rule increases the probability of the second rule by at 
least 0.5 

Figure 3: Spikes in ISIS VBIED Activity in Iraq and 
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Spikes in lED Incidents. Improvised explosive device 
(lED) incidents have been a common tactic used by Iraqi in¬ 
surgents throughout the U.S.-led Operation Iraqi Freedom. 
Though the lED comprises a smaller weapons system nor¬ 
mally employed by local insurgent cells, spikes in such ac¬ 
tivity could be meaningful. For instance, it may indicate 
action ordered by a strategic-level command that is being 
carried out on the city level, or it may indicate improved 
logistic support to provide local cells the necessary muni¬ 
tions to carry out such operations in larger numbers. Such 
spikes only occur with a prior probability of 0.19. In Table[^ 
we show a rather strong precondition for such attacks that 
consist of infantry operations in Tikrit and a spike in exe¬ 
cutions. In this Table, rule 4 states that infantry operations 
in Tikrit, when accompanied by a spike in executions, lead 
to a spike (1 x a) (see figure]^ in Iraq and Syria combined 
- with a probability of 1.0 - much higher than the prior of 
the consequence. With tavg of 0.97 (based on a compari¬ 
son with 1180 other rules), this relationship appears highly 
causal (tfrac = 1.0, Emin = 0.0) although 40% of 1 X (T lED 
spikes were not accounted for by this precondition. 

Table 5: Causal Rules for Spikes in lED Incidents in Iraq 
and Syria Combined 


No. 

Precondition 

^avg 

P 

P* 

4. 

armedAtk(Tifcrit)A 

executionSpike(rota/, 2a) 

0.97 

1.00 

0.40 


4.4 Relationships between Iraqi and Syrian The¬ 
aters 

ISIS has clearly leveraged itself as a force operating in 
both Iraq and Syria, and the identification of relationships 




















Figure 4: Spikes in ISIS lEDs in Iraq and Syria per 
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Figure 6: Comparison of ISIS Armed Attacks and 
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between incidents in relation to the two theaters may in¬ 
dicate some sophisticated operational coordination on their 
part. We have found some evidence of these cross-theater 
relationships with regard to suicide operations in Iraq (po¬ 
tentially affected by other events in Syria) and VBIED op¬ 
erations in Syria (potentially affected by other operations in 
Iraq). 

VBIED Spikes in Syria. Table E shows our most causal 
rules whose consequence is a 1 x cr spike (over the four-month 
moving average) (see figures in ISIS VBIED events in 
Syria. Rule 5 provides a precondition of a spike in armed 
attacks in Iraq that includes a major spike in indirect fire 
activity while rule 6 has the same precondition but includes 
an additional VBIED event in Baghdad. We believe that 
the spike in armed attacks indicates major ISIS operations 
in Iraq and the inclusion of indirect fire events also indicates 
that ISIS soldiers specializing in weapon systems such as 
mortars may also be concentrated in Iraqi operations. Taken 
together, this may indicate a shift in ISIS resources toward 
Iraq - which may mean that operations have shifted away 
from Syria. Hence, VBIED attacks, which once prepared, 
are less manpower-intensive, nevertheless provide a show- 
of-force in the secondary theater. We also note that the 
probability of these rules (1.00) is significantly higher than 
the prior of these spikes (0.19) and that the causality value is 
also high for each of the 983 related rules, as the probability 
either remains the same or increases when considering one 
of these preconditions (in other words, tfrac = 1 and emin = 
0 ). 


Figure 5: Spikes in ISIS VBIEDs in Syria per Week 



Table 6: Causal Rules for Spikes in VBIED Operations in 
Syria 


No. 

Precondition 

^avg 

P 

* 

P 

5. 

armedAtkSpike(/ra(j', ct)A 

indirFireSpike(/rag, 2 ct) 

0.92 

1.00 

0.20 

6. 

armedAtkSpike(/rog, ct)A 

indirFireSpike(Ira 5 , 2ct)A 

yB\ED{Baghdad) 

0.92 

1.00 

0.20 


Operations Shifting to Syria. In rules 5 and 6 of Ta¬ 
ble we saw how increased operations in Iraq led to the 
use of VBIEDs in Syria - perhaps due to a focus on more 
manpower-heavy operations in Iraq. Interestingly, rule 7 
shown in Table indicates that less manpower-intensive 
operations in Iraq that have a terror component seem to 
have a causal relationship (based on tavg = 0.97, e/rac = 
1.0, tmin = 0.5 found by comparing to 95 related rules) with 
significant indirect fire operations in Syria (that occur with a 
prior probability of 0.08). As discussed earlier, indirect fire is 
normally used to “prepare the battlefield” for infantry oper¬ 
ations, so this rule may be indicative of a shift in manpower 
toward Syria - and the use of a VBIED tactic in Baghdad 
(less manpower-intensive but very sensational) seems to al¬ 
ways proceed a major (2 x ct over the moving average) spike 
in indirect fire activity in Syria in our data (hence, a negative 
probability of 0.0). 

Table 7: Causal Rules for Spikes in Indirect Fire Opera¬ 
tions in Syria 


No. 

Precondition 

^avg 

P 

P* 

7. 

\ED{Baghdad)A 
\/B\ED (Ramadi) 

0.97 

0.67 

0.00 


4.5 ISIS Activities Related to Opposition Air 
Strikes 

Reaction to Syrian Government Air Strikes. Rule 8, 
shown in Table tells us that a 2 x ct spike in arrests (see 
figure was always (p* = 0.0) proceeded by an air strike 
conducted by the Syrian government. The prior probability 

























Table 8: Causal Rules for Spikes in Arrests (Iraq and Syria 
Combined) 


No. 

Precondition 

^avg 

P 

P* 

8. 

airStrike(S'j/rianGou, Damascus) 

0.91 

0.67 

0.00 


for such a spike in arrests is 0.08. Further, we found evidence 
of causality - the actions of the Syrian government raised the 
probability of each of 33 related rules by at least 0.5. One 
potential reason to explain why arrests follow Syrian air op¬ 
erations is that unlike western nations, Syria generally lacks 
advanced technical intelligence-gathering capabilities to de¬ 
termine targets, and Syria likely relies on extensive human 
intelligence networks - especially within Iraq and Syria. Suc¬ 
cessful targeting from the air by the Syrian government may 
then indicate that ISIS’s counter-intelligence efforts (activi¬ 
ties designed to locate spies within its ranks) may have failed 
and so the organization perhaps then decides to conduct 
massive arrests. 


personnel) - hence, it may seek a more economical attack 
(in terms of both manpower and equipment) that still has 
a significant terror component - and it would appear that a 
suicide attack provides a viable option to respond to such 
air strikes. 

Figure 8: Spikes in ISIS Suicide Operations in Iraq 
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Figure 7: Spikes in ISIS Arrests in Iraq and Syria 
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Table 9: Causal Rules for Major Spikes in Suicide Opera¬ 
tions in Iraq 


No. 

Precondition 

^avg 

P 

P 

9. 

airStrike(7ragGout, Baiji)f\ 

armedAtk(i3aZad)A 

yB\ED{Baghdad) 

0.71 

0.67 

0.60 


Reaction to Iraqi Government Air Strikes. In Table|^ 

rule 9 tells us that a 2 x cr spike (see figure]^ in suicide op¬ 
erations in Iraq is related to a precondition involving Iraqi 
aerial operations in Baiji, ISIS infantry operations in Balad, 
and a VBIED in Baghdad. The rule shows that these spikes 
in suicide operations are 3.5 times more likely with this pre¬ 
condition. Though €avg is lower than some of the other rules 
presented thus far, it has a value for Smin of 0.3 - the mini¬ 
mum increase in probability afforded to any of the 82 related 
rules to which we add the precondition of rule 9. The pre¬ 
condition indicates that ISIS may have recently expended a 
VBIED (expensive in terms of equipment) while it has on¬ 
going infantry operations in Balad (expensive in terms of 


Table 10: Causal Rules for Major Spikes in lED Operations 
in Iraq 


No. 

Precondition 

^avg 

P 

P* 

10. 

airStrike(Goalition, Mosul)A 

armedAtk{Fallujah) 

0.97 

0.67 

0.33 


Table 11: Causal Rules for Major Spikes in lED Operations 
in Syria 


No. 

Precondition 

^avg 

P 

P 

11. 

a\rStnke{Coalition, Mosul)A 

armedAtk(Ramadi)A 

armedAtkSpike(S'i/ria, cr) 

0.79 

0.67 

0.33 


Reaction to Air Strikes by the U.S.-led coalition. 

Rules 10 {efrac = i-0,€min = 0.5,562 related rules) and 
11 (efrac = ^■0,emin = 0.38,81 related rules) - shown in 
Tables [iO] and m- illustrate two different outcomes from 
coalition air operations in Mosul. In both cases, ISIS has 
active operations in the Al-Anbar province - both Ramadi 
and Fallujah have similar demographics. Hence, the major 
difference is that the precondition of rule 11 also includes 
significant infantry operations in Syria. So, even though 
both rules result in an increase in lED activity (2 x cr above 
average, a spike that in both cases occurs with a prior prob¬ 
ability of 0.12) (see figures]^ 101 - the increase occurs in Iraq 
for rule 10 and Syria for rule 11. It may be the case that 
ISIS is increasing lED activity in response to coalition air 
strikes in the location of their main effort. Further, the rel¬ 
atively low negative probability (0.33) along with relatively 
high values for emin. may indicate that coalition air strikes 
in Mosul are likely viewed as important factors contributing 
to ISIS decisions to increase lED activity. We may also note 
that the use of lED activity in the aftermath of coalition 
















































air strikes could also be due to the size of the weapon. An 
lED can be fairly small, easily disassembled and stored in 
an innocuous location - hence, it is weapon system that the 
coalition cannot sense and target from the air. 


Figure 9: Spikes in ISIS lEDs in Iraq per Week 
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5. RELATED WORK 

To the best of our knowledge, this paper represents the 
first pnrely data-driven stndy of ISIS, and it is also the first 
to combine the causality framework of |10| with APT-Logic. 
However, there has been a wealth of research conducted 
where rule-based systems have been applied to terrorist and 
insurgent groups, as well as other work on modeling insur¬ 
gent actions. Here, we review this related work and also 
discuss other approaches to causal reasoning. 


Rule-based systems. Previously, there has been a vari¬ 
ety of research on modeling the actions of terrorist and in¬ 
surgent groups. Perhaps most well-known is the Stochastic 
Opponent Modeling Agents (SOMA) 12 , which was de¬ 
veloped with the goal of better understanding different cul¬ 
tural groups along with their behaviors. This is also based on 
a rule-based framework known as action-probabilistic (AP) 
rules [sl, which is a predecessor of APT-logic used in this 
paper |14| 15 . The SOMA system produces a probabilistic 


logic representation for understanding group behaviors and 
reasoning about the types of actions a group may take. In re¬ 
cent years, this system has been used to better understand 
terror groups like Hamas and Hezbollah through 
probabilistic rules. However, it can also be used with cul¬ 
tural, religious, and political groups - as it has been demon¬ 


strated with other groups in the Minorities at Risk Orga¬ 
nizational Behavior (MAROB) dataset [^. The work on 
SOMA was followed by an adoption of APT-Logic [14| |15| , 
which extended AP-rules with a temporal component. APT 
logic was also applied to the groups of the MAROB dataset 
as well as Shi’ite Iraqi insurgent groups circa 2007 (p rese nt 
during the American-led Operation Iraqi Freedom) 


15 


0 


Perhaps most significantly, APT-Logic was applied to an¬ 
other dataset for the study of the terror groups Lashkar-e- 
Taiba (LeT) and Indian Mujahideen (IM) in two compre¬ 
hensive volumes that discuss the policy implications of the 
behavioral rules learned in these cases [171 16 . The main 


similarity between the previous work leveraging SOMA, AP- 
rules, and/or APT-logic and this paper is that both leverage 
probabilistic rule learning. However, all of the aforemen¬ 
tioned rule-learning approaches only discover correlations, 
while this work is focused on rules that are not only of high 
probability, but also have a likely casual relationship. We 
also note that none of this previous work studies ISIS but 
rather other terrorist and insurgent groups. 


Analysis of insurgent military tactics. We also note 
that the previous rule-learning approaches to understanding 
terrorist and insurgent behavior have primarily focused on 
analyzing political events and how they affect the actions of 
groups such as LeT and IM. However, with the exception 
of some of the work on APT-Logic which studies Shi’ite 
Iraqi insurgents |14| , the aforementioned work is generally 
not focused on tactical military operations - unlike this pa¬ 
per. However, there have been other techniques introduced 
in the literature that have been designed to better account 
for ground action. Previously, a st atistical-based approach 
leveraged leaked classihed data 19 ^to predict trends of vi¬ 
olent activity during the American-led Operation Enduring 
Freedom in Afghanistan. However, this work was primarily 
focused on prediction and not identifying causal relation¬ 
ships of interest to analysis as in this work. We also note 
that this work does not rely on the use of leaked classified 
data, but rather on open-source information. Another inter¬ 
esting approach is the model-based approach of [^ , in which 
subject matter experts create models of insurgent behavior 
using a combination of fuzzy cognitive maps and complex 
networks to run simulations and study “what-if” scenarios. 
However, unlike this paper, the work of is not as data- 
driven an approach. 


Causal reasoning. The comparison of rules by tavg as a 
measure of causality was first introduced in and further 
studied in [^. It draws on the philosophical ideas of [18| . 
However, this work has primarily looked at preconditions as 
single atomic propositions. Further, it did not explore the 
issue of efficiency. As we look to identify rules whose pre¬ 
condition consists of more than one atomic proposition, we 
introduce a rule-learning approach. Further, moving beyond 
previous rule-learning approaches such as that introduced in 
and [14] , we show practical techniques to improve efficien¬ 
cies of such algorithms. Further, we also improve upon the 
efficiency of computing eavg - a practical issue not discussed 
in [10| [^. We note that neither this previous work on causal- 

^ISIS is a Sunni group and did not exist in its present form 
in 2007. 

^Resulting from WikiLeaks in 2010. 


















ity nor APT-logic makes independence assumptions. This 
differs substantially from earlier work on causality such as 
[13| , which relies on graphical models that make relatively 
strong independence assumptions. Our goal was to avoid 
such structures in order to provide a more purely data-driven 
approach. A key aspect of this work as opposed to previ¬ 
ous studies on causality is that we leverage the intuitions 
of APT logic and AP rules, in which the rule-learning algo¬ 
rithm searches for combinations of atomic propositions that 
are related to a given consequence. 

6. CONCLUSION 

In this paper, we conducted a data-driven study on the in¬ 
surgent group ISIS using a combination of APT-logic, rule 
learning, and causal reasoning to identify cause-and-elfect 
behavior rules concerning the group’s actions. We believe 
our approach is of significant utility for both military deci¬ 
sion making and the creation of policy. In the future, we 
look to extend this work in several ways: first, we look to 
create non-ground rules that generalize some of the precon¬ 
ditions further. This would allow us to understand the cir¬ 
cumstances in which ISIS conducts general operations (as 
opposed to operations specihc to a given city or to a geo¬ 
graphic area). We also look to study more complex temporal 
relationships - possibly using a more fine-grain resolution for 
time and studying rules where the cause is followed by the 
effect in more than one unit of time. We also look to leverage 
additional variables about the environment, including data 
about weather, information (including social media opera¬ 
tions), and the political situation to find more interesting 
relationships. 
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